: how to get USB busid from minifilter driver

NTFSD
21

i dont see much difference but surely, make these changes

data[23]= *(DWORD)*volumeextents->Extents[0].DiskNumber+0x30;

and

IoGetDeviceObjectPointer(&devicename,*FILE_READ_ATTRIBUTES*,&file,&device);

On Thu, Apr 1, 2010 at 5:01 PM, wrote:

> I would be glad, if someone can say me how to get the USBSTOR object.
>
> KEVENT WaitEvent;
> PIRP NewIrp;
> NTSTATUS status1;
> PDEVICE_OBJECT ndevice;
> PDEVICE_OBJECT device;
> PFILE_OBJECT file;
> ULONG lenght;
> WCHAR hwId[256];
> PVOLUME_DISK_EXTENTS volumeextents;
> PUNICODE_STRING devicename;
> wchar_t data[25];
>
> KeInitializeEvent(&WaitEvent, NotificationEvent, FALSE);
> volumeextents =
> ExAllocatePoolWithTag(NonPagedPool,sizeof(VOLUME_DISK_EXTENTS), 500);
> NewIrp =
> IoBuildDeviceIoControlRequest(IOCTL_VOLUME_GET_VOLUME_DISK_EXTENTS,
> DeviceObject,
> NULL, 0,
> (PVOID)volumeextents, sizeof(VOLUME_DISK_EXTENTS),
> FALSE, &WaitEvent, &IoStatus);
>
> if (!NewIrp) {
> DbgPrint(“Failed to create new
> IRP,IOCTL_VOLUME_GET_VOLUME_DISK_EXTENTS”);
> ExFreePoolWithTag(volumeextents, 500);
> return;
> }
>
> // send this irp to the storage device
> irpnext = IoGetNextIrpStackLocation(NewIrp);
> DbgPrint(“Setze jetz IoCall ab!\n”);
> Status = IoCallDriver(DeviceObject, NewIrp);
>
> if (Status == STATUS_PENDING) {
> Status = KeWaitForSingleObject(&WaitEvent, Executive,
> KernelMode, FALSE,
> NULL);
> Status = IoStatus.Status;
> }
>
> if (!NT_SUCCESS(Status)) {
> DbgPrint(“IOCTL_VOLUME_GET_VOLUME_DISK_EXTENTS failed,
> status =0x%x”, Status);
> ExFreePoolWithTag(volumeextents, 500);
> return;
> }
>
> wcscpy(data,L"\GLOBAL??\PhysicalDrive");
> data[23]= volumeextents->Extents[0].DiskNumber+0x30;
> data[24]=0;
> RtlInitUnicodeString(&devicename,data);
> ExFreePoolWithTag(volumeextents, 500);
> IoGetDeviceObjectPointer(&devicename,FILE_WRITE_DATA,&file,&device);
> ndevice = IoGetDeviceAttachmentBaseRef(device);
> status1 = IoGetDeviceProperty(ndevice,DevicePropertyHardwareID,sizeof
> (hwId),hwId,&lenght);
> if (!NT_SUCCESS(status1)) {
> DbgPrint(" failed, status =0x%x", status1);
> return;
> }
>
>
> —
> NTFSD is sponsored by OSR
>
> For our schedule of debugging and file system seminars
> (including our new fs mini-filter seminar) visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>

22

great!!! thanks, that was it - now i got the USBSTOR object :-))))

23

Good to hear.

any how what made the difference?

On Thu, Apr 1, 2010 at 5:42 PM, wrote:

> great!!! thanks, that was it - now i got the USBSTOR object :-))))
>
> —
> NTFSD is sponsored by OSR
>
> For our schedule of debugging and file system seminars
> (including our new fs mini-filter seminar) visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>

24

I suspect that not asking for data access in the open was the difference.

-scott

–
Scott Noone
Consulting Associate
OSR Open Systems Resources, Inc.
http://www.osronline.com

“Dennis Scott” wrote in message
news:xxxxx@ntfsd…
Good to hear.

any how what made the difference?

On Thu, Apr 1, 2010 at 5:42 PM, wrote:

great!!! thanks, that was it - now i got the USBSTOR object :-))))

—
NTFSD is sponsored by OSR

For our schedule of debugging and file system seminars
(including our new fs mini-filter seminar) visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

25

to mike meyers:

are these code wrote in minifilter??

RE: : how to get USB busid from minifilter driver

I would be glad, if someone can say me how to get the USBSTOR object.

KEVENT WaitEvent;
PIRP NewIrp;
NTSTATUS status1;
PDEVICE_OBJECT ndevice;
PDEVICE_OBJECT device;
PFILE_OBJECT file;
ULONG lenght;
WCHAR hwId[256];
PVOLUME_DISK_EXTENTS volumeextents;
PUNICODE_STRING devicename;
wchar_t data[25];

KeInitializeEvent(&WaitEvent, NotificationEvent, FALSE);
volumeextents = ExAllocatePoolWithTag(NonPagedPool,sizeof(VOLUME_DISK_EXTENTS),
500);
NewIrp = IoBuildDeviceIoControlRequest(IOCTL_VOLUME_GET_VOLUME_DISK_EXTENTS,
DeviceObject,
NULL, 0,
(PVOID)volumeextents, sizeof(VOLUME_DISK_EXTENTS),
FALSE, &WaitEvent, &IoStatus);

if (!NewIrp) {
DbgPrint(“Failed to create new IRP,IOCTL_VOLUME_GET_VOLUME_DISK_EXTENTS”);
ExFreePoolWithTag(volumeextents, 500);
return;
}

// send this irp to the storage device
irpnext = IoGetNextIrpStackLocation(NewIrp);
DbgPrint(“Setze jetz IoCall ab!\n”);
Status = IoCallDriver(DeviceObject, NewIrp);

if (Status == STATUS_PENDING) {
Status = KeWaitForSingleObject(&WaitEvent, Executive, KernelMode, FALSE,
NULL);
Status = IoStatus.Status;
}

if (!NT_SUCCESS(Status)) {
DbgPrint(“IOCTL_VOLUME_GET_VOLUME_DISK_EXTENTS failed, status =0x%x”, Status);
ExFreePoolWithTag(volumeextents, 500);
return;
}

wcscpy(data,L"\GLOBAL??\PhysicalDrive");
data[23]= volumeextents->Extents[0].DiskNumber+0x30;
data[24]=0;
RtlInitUnicodeString(&devicename,data);
ExFreePoolWithTag(volumeextents, 500);
IoGetDeviceObjectPointer(&devicename,FILE_WRITE_DATA,&file,&device);
ndevice = IoGetDeviceAttachmentBaseRef(device);
status1 = IoGetDeviceProperty(ndevice,DevicePropertyHardwareID,sizeof
(hwId),hwId,&lenght);
if (!NT_SUCCESS(status1)) {
DbgPrint(" failed, status =0x%x", status1);
return;
}

26

yes this code is wrote in a minifilter

27

so these code were worte in PRECREATE or other dispatcher?i’am trying to block operations about usb mass storage,but device type i got always be FILE_DEVICE_DISK_FILE_SYSTEM,can you suggest me somthing usefull ,thx a million!!